PT-2026-97434

Name of the Vulnerable Software and Affected Versions GoCD versions 20.2.0 through 26.0.x Description An internal pipeline structure API used for autocompletion during the editing of pipeline, template, environment, and user-preference configurations allows regular authenticated users to access t...

CVE-2026-96271: Authorization Bypass Through User-Controlled Key

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing...

PT-2026-97370

Name of the Vulnerable Software and Affected Versions HumHub version 1.18.5 Description A stored cross-site scripting XSS issue exists where a user with the delegated, non-system-administrator admin manage users permission can inject persistent HTML or JavaScript into a Profile Field Category...

Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token,...

CVE-2026-91073: Improper Neutralization of Input During Web Page Generation

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a...

CVE-2026-86583: Incorrect Privilege Assignment

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv with a NUL byte \0 as...

CVE-2026-86681: Missing Authentication for Critical Function

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope...

PT-2026-97669

This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token,...

PT-2026-97569

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts...

PT-2026-97604

Name of the Vulnerable Software and Affected Versions Import and export users and customers plugin for WordPress versions prior to 2.4.18 Description An issue exists in the export and re-import workflow that allows authenticated users with Subscriber-level access or higher to escalate their...

Linux Distros Unpatched Vulnerability : CVE-2026-61628

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticat...

CVE-2026-89282

The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:, which inherits write access for Authenticated Users...

CVE-2026-89282 CVE-2026-89282

The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:, which inherits write access for Authenticated Users...

CVE-2026-89282

The Apache Lounge Windows distribution of the Apache HTTP Server contains an insecure installation directory permissions vulnerability. The issue stems from the default installation directory on **C:**, which incorrectly inherits write access for Authenticated Users . No specific remediation, exp...

CVE-2026-89282 CVE-2026-89282

The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:, which inherits write access for Authenticated Users...

EUVD-2026-84680

The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:, which inherits write access for Authenticated Users...

CVE-2026-77256 MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the plaintext OAuth fallback file containing refresh and access tokens is written with permissions inherited from the process umask. Under common or permissive configurations, other...

CVE-2026-77268 MCP Atlassian: Insecure File Permissions on OAuth Token Storage

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bi...

CVE-2026-43643 Softaculous Virtualizor Authorization Bypass via Billing Module Handler

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

EUVD-2026-84619

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, OAuthConfig writes a plaintext fallback file containing access and refresh tokens under the user's .mcp-atlassian directory using process-default permissions. On systems with a...